Metasploit Framework Web Service Has Unauthenticated Credential Access Flaw

Rapid7 has released version 6.5.5 of the Metasploit Framework to address a critical security vulnerability that allows unauthenticated access to stored credentials. The flaw, tracked as CVE-2026-87689, enables attackers to read, modify, or permanently delete sensitive authentication data if they can reach the web service interface.

The vulnerability resides within the Metasploit Framework Web Service REST API, specifically in the Msf::WebServices::CredentialServlet component. According to the National Vulnerability Database record, this servlet handles various credential management routes. While most mutating and read routes correctly require authentication via warden.authenticate!, two specific handlers fail to enforce this security control.

Context and Background

The affected handlers are the update_credential function for PUT requests and the delete_credentials function for DELETE requests on the /api/v1/credentials endpoint. These specific API routes omitted the standard authentication call entirely before processing user inputs. This deviation from the standard security pattern left these endpoints exposed to direct manipulation by any network client.

Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no independent authorization checks, the lack of initial authentication proves fatal. Any client able to reach the web service on its default 0.0.0.0:8080 listener can interact with the credential store without presenting any valid credentials or tokens.

Who Is Affected

All published versions of the Metasploit Framework up to and including version 6.5.4 are affected by this issue. The vulnerability is rated as critical with a CVSS score of 9.8. Attackers exploiting this flaw can access every stored credential record within the database, including passwords, cryptographic hashes, and private keys used for shared team engagements.

The fix introduced in version 6.5.5 adds the warden.authenticate! call as the first statement in both the update and delete handlers. This change aligns these specific routes with the security pattern used by every other route in the API, ensuring that all requests are properly authenticated before processing.

What should you do?

Security teams should immediately verify their current Metasploit Framework version. If the installation is version 6.5.4 or earlier, administrators should upgrade to version 6.5.5 to apply the patch. Until the update is applied, organizations should restrict network access to the Metasploit Web Service port 8080 to prevent unauthorized external connections.